At the beginning of July this year, the issue of proceedings by the Office of Competition and Consumer Protection in the context of violations of RODO (personal data protection) regulations became notorious. This was due to a judgment of the Court of Justice of the European Union, which ruled on whether a local authority examining the dominant position of an entrepreneur on competition grounds (in Poland this is the Office of Competition and Consumer Protection) can also verify violations of RODO regulations in the course of its proceedings. The doubt was whether these issues should not be reserved exclusively for the supervisory authority for personal data protection.
Facts: Meta Platforms vs. Bundeskartellamt, (judgment of July 4, 2023, ref.: C-252/21)
The Court’s decision came against the background of the following case. The German Federal Office of Consumer Protection (Bundeskartellamt – the equivalent of our OCCP) was handling a case of abuse of a dominant position by an entrepreneur. The challenged practice of the entrepreneur consisted in forcing consent to send integrated personal data for the purpose of, in particular, personalization of advertising and direct marketing. According to the authority hearing the case, this constituted a violation of competition rules arising from abuse of a dominant market position. The authority doubted, however, that since the identified infringement involved personal data, and there is a separate supervisory authority dedicated to such matters, whether the Bundeskartellamt could make a binding statement in this regard.
CJEU findings on the identification of RODO violations by other authorities
The Court of Justice of the EU, in deciding the case under review, pointed out that the examination of an entrepreneur’s dominant position can be based not only on competition law, but also on other regulations, including the RODO – but only to the extent necessary to establish an abuse of dominance. To go beyond this framework would be a clear overreach of authority. Thus, the competition authority cannot assess other violations of the RODO that would be unrelated to the investigation.
It was also emphasized that since the assessment of compliance with data protection regulations is the responsibility of another authority, the authority hearing the case should verify whether the issue has already been resolved and be consistent in this regard. If a situation has already been the subject of an assessment, such an adjudication cannot be disregarded and its own findings made. The CJEU recognizes the need for cooperation between authorities upholding the protection of competition and the protection of privacy.
CJEU conclusions on social media vs. RODO
In order to maintain that interpretive consistency of the RODO provisions mentioned above, the CJEU also commented on the specific facts of the case. I summarize what are the more interesting findings in the context of social media activity below.
Although browsing websites, responding to their content (e.g., liking, etc.) or writing comments may lead to the disclosure of sensitive data, such activities cannot constitute obvious public disclosure (i.e., we cannot invoke Article 9(2)(e) of the RODO). However, such an obvious public disclosure may occur if the data subject has previously given explicit consent to make his or her data publicly available to an unlimited number of people.
The performance of a contract is the basis for the processing of personal data only if it is genuinely necessary, and the purpose of the contract would not have been achieved without such processing (so we have here the full realization of the principle of purposefulness of processing and data minimization).
Personalization of the content of advertisements may be based on legitimate interest (Article 6(1)(f) RODO), but only if the following conditions are met together:
- the controller has indicated to the users from whom the data was obtained the legitimate interest for the fulfillment of which the processing of such data is carried out;
- the processing is carried out within the limits of what is absolutely necessary to realize this legitimate interest,
- the so-called “balancing test” has been performed,
- from the balancing of the opposing interests of the users (as data subjects), it follows that the interests or fundamental rights and freedoms of the users do not take precedence over this
- legitimate interest of the controller or a third party.
If these prerequisites are not met, personalization of advertisements should be based on the user’s express consent.
The controller’s dominant position does not preclude the freedom to give consent to data processing, but this imbalance between the data subject and the controller may lead to questioning the voluntariness of consent.
OCCP can check RODO – practical consequences
Transferring the above to Polish regulations, the CJEU has determined that if an issue related to personal data protection arises in proceedings before the PUODO, under certain conditions the PUODO will be able to resolve it on its own. It will not be necessary to initiate a separate proceeding before the PUODO to determine such a violation. However, it should be borne in mind that the OCC’s settlement must address competition issues and be consistent with the PUODO’s position in this regard. Both PUODO and the OCCP should therefore cooperate closely.